CVE-2026-89275

Adobe Campaign Classic (ACC) contains an improper control of code generation flaw (CWE-94) that allows arbitrary code execution. Because the vulnerability is network-exploitable with no privileges, no user interaction, and a changed scope, it is rated a perfect 10.0 on CVSS 3.1 — an unauthenticated attacker who can reach an affected instance could inject and execute arbitrary code on the underlying server. This puts enterprise marketing automation deployments at risk, including any customer data, campaign workflows, and connected integrations they hold. No affected version range was included in the provided data, so defenders should consult Adobe's own security bulletin for the precise patched versions. As of now, there is no known public proof of concept and the issue is not on CISA's KEV list.

What to do: Apply Adobe's patch immediately once the fixed build is identified in the relevant APSB bulletin, prioritizing any instance reachable from the internet. Restrict network access to Campaign Classic application and delivery servers (VPN/IP allowlisting) so only administrators and required integrations can reach them. Review server logs for unexpected code execution, suspicious workflow activity, or new scheduled tasks on ACC hosts, and rotate credentials stored in Campaign if compromise is suspected.